Aeion Auth + GitHub — SSO for Developer Audiences
"Sign in with GitHub" — the right default for developer tools, dev-first SaaS, and any product targeting engineering buyers. Aeion's `github` OAuth provider handles the standard OAuth 2.0 flow against github.com.
When This Integration Matters
GitHub SSO is the right default when your buyer / user is a developer. The conversion lift over "create an account with email + password" is large — most developers have an existing GitHub session and the social-proof of "this product respects my GitHub identity" lands well.
Step 1 — GitHub OAuth App Setup
Create a new OAuth App in your GitHub account or organization.
Step 2 — Aeion Auth Config
```bash
The Email Quirk
GitHub doesn't return the user's primary email in the /user userinfo response unless the user has set it to public — even when you've granted the user:email scope. Aeion's GitHub callback currently reads profile.email straight from that response; it does not yet fall back to GitHub's separate /user/emails endpoint when the field is null. In practice this means users with a private GitHub email will sign in successfully but land with OAuthUser.email === undefined — handle that case in your application (e.g., prompt for an email on first login) rather than assuming every GitHub sign-in resolves an address.
Token Flow Specifics
- Default scopes:
read:user+user:email(not currently configurable — this is the fixed default Aeion requests)
Common Gotchas
- "redirect_uri_mismatch" — GitHub matches the callback URL exactly. Trailing slashes matter. Localhost dev requires the exact
http://localhost:<port>/...callback registered.
FAQ
Historical privacy default — GitHub users can mark their email as private, and GitHub omits it from the `/user` response in that case. Aeion reads whatever `/user` returns; if the user's email is private, sign-in still succeeds but `OAuthUser.email` comes back empty.
Not built in today — there's no org-membership check in Aeion's GitHub callback. If you need this, gate it in your own application logic after sign-in (e.g., check the user's org membership via a separate authenticated API call).
Yes — Enterprise Cloud uses the same github.com OAuth endpoints as consumer GitHub, so no extra config is needed. Self-hosted GitHub Enterprise Server (with its own domain) isn't currently supported as a separate configuration.
Not via configuration today — Aeion requests the fixed default (`read:user` + `user:email`) on every GitHub sign-in.